Buggy code:
public class SAMLSSOValve extends SingleSignOn { private static final Logger logger = Logger . getLogger ( SAMLSSOValve . class . getName ( ) ) ; private Properties ssoSPConfigProperties ; public SAMLSSOValve ( ) throws SSOException { } @ Override public void invoke ( Request request , Response response ) throws IOException , ServletException { SAMLSSOValve . logger . log ( Level . FINE , ( "Invoking<seq2seq4repair_space>SAMLSSOValve.<seq2seq4repair_space>Request<seq2seq4repair_space>URI<seq2seq4repair_space>:<seq2seq4repair_space>" + ( request . getRequestURI ( ) ) ) ) ; <START_BUG> if ( ! ( SSOUtils . singleSignOnEnabled ( ) ) ) { <END_BUG> SAMLSSOValve . logger . log ( Level . FINE , ( "SAML2<seq2seq4repair_space>SSO<seq2seq4repair_space>not<seq2seq4repair_space>enabled<seq2seq4repair_space>in<seq2seq4repair_space>webapp<seq2seq4repair_space>" + ( request . getContext ( ) . getName ( ) ) ) ) ; getNext ( ) . invoke ( request , response ) ; return ; } SSOAgentConfiguration ssoAgentConfiguration ; Optional ssoAgent = Optional . ofNullable ( request . getSessionInternal ( ) . getNote ( SSO_AGENT_CONFIG ) ) ; if ( ! ( ssoAgent . isPresent ( ) ) ) { try { ssoAgentConfiguration = new SSOAgentConfiguration ( ) ; ssoAgentConfiguration . initConfig ( ssoSPConfigProperties ) ; ssoAgentConfiguration . getSAML2 ( ) . setSSOAgentX509Credential ( new SSOX509Credential ( ssoSPConfigProperties ) ) ; Optional . of ( SAMLSSOUtils . generateIssuerID ( request . getContextPath ( ) ) ) . ifPresent ( ( id ) -> ssoAgentConfiguration . getSAML2 ( ) . setSPEntityId ( ( ( String ) ( id . get ( ) ) ) ) ) ; Optional . of ( SAMLSSOUtils . generateConsumerUrl ( request . getContextPath ( ) , ssoSPConfigProperties ) ) . ifPresent ( ( url ) -> ssoAgentConfiguration . getSAML2 ( ) . setACSURL ( ( ( String ) ( url . get ( ) ) ) ) ) ; ssoAgentConfiguration . verifyConfig ( ) ; request . getSessionInternal ( ) . setNote ( SSO_AGENT_CONFIG , ssoAgentConfiguration ) ; } catch ( SSOException e ) { SAMLSSOValve . logger . log ( Level . SEVERE , "Error<seq2seq4repair_space>on<seq2seq4repair_space>initializing<seq2seq4repair_space>SAML2SSOManager" , e ) ; return ; } } else { ssoAgentConfiguration = ( ( SSOAgentConfiguration ) ( ssoAgent . get ( ) ) ) ; } try { SSOAgentRequestResolver requestResolver = new SSOAgentRequestResolver ( request , ssoAgentConfiguration ) ; if ( requestResolver . isURLToSkip ( ) ) { SAMLSSOValve . logger . log ( Level . FINE , "Request<seq2seq4repair_space>matched<seq2seq4repair_space>a<seq2seq4repair_space>skip<seq2seq4repair_space>URL.<seq2seq4repair_space>Skipping..." ) ; getNext ( ) . invoke ( request , response ) ; return ; } SAML2SSOManager saml2SSOManager ; if ( requestResolver . isSAML2SLORequest ( ) ) { SAMLSSOValve . logger . log ( Level . FINE , "Processing<seq2seq4repair_space>Single<seq2seq4repair_space>Log<seq2seq4repair_space>Out<seq2seq4repair_space>Request..." ) ; saml2SSOManager = new SAML2SSOManager ( ssoAgentConfiguration ) ; saml2SSOManager . performSingleLogout ( request ) ; } else if ( requestResolver . isSAML2SSOResponse ( ) ) { SAMLSSOValve . logger . log ( Level . FINE , "Processing<seq2seq4repair_space>SSO<seq2seq4repair_space>Response..." ) ; saml2SSOManager = new SAML2SSOManager ( ssoAgentConfiguration ) ; String redirectPath = saml2SSOManager . readAndForgetRedirectPathAfterSLO ( request , ssoSPConfigProperties . getProperty ( REDIRECT_PATH_AFTER_SLO ) ) ; saml2SSOManager . processResponse ( request ) ; String relayStateId = ssoAgentConfiguration . getSAML2 ( ) . getRelayState ( ) ; if ( ( Optional . ofNullable ( relayStateId ) . isPresent ( ) ) && ( Optional . ofNullable ( request . getSession ( false ) ) . isPresent ( ) ) ) { Optional < RelayState > relayState = Optional . ofNullable ( ( ( RelayState ) ( request . getSession ( false ) . getAttribute ( relayStateId ) ) ) ) ; if ( relayState . isPresent ( ) ) { request . getSession ( false ) . removeAttribute ( relayStateId ) ; StringBuilder requestedURI = new StringBuilder ( relayState . get ( ) . getRequestedURL ( ) ) ; Optional . ofNullable ( relayState . get ( ) . getRequestQueryString ( ) ) . ifPresent ( ( queryString ) -> requestedURI . append ( "?" ) . append ( queryString ) ) ; Optional . ofNullable ( relayState . get ( ) . getRequestParameters ( ) ) . ifPresent ( ( queryParameters ) -> request . getSession ( false ) . setAttribute ( SSOConstants . SAMLSSOValveConstants . REQUEST_PARAM_MAP , relayState . get ( ) . getRequestParameters ( ) ) ) ; response . sendRedirect ( requestedURI . toString ( ) ) ; } else { response . sendRedirect ( ( ( ssoSPConfigProperties . getProperty ( APP_SERVER_URL ) ) + ( request . getContextPath ( ) ) ) ) ; } } else if ( ( request . getRequestURI ( ) . endsWith ( ssoSPConfigProperties . getProperty ( CONSUMER_URL_POSTFIX ) ) ) && ( Boolean . parseBoolean ( ssoSPConfigProperties . getProperty ( HANDLE_CONSUMER_URL_AFTER_SLO ) ) ) ) { response . sendRedirect ( redirectPath ) ; } return ; } else if ( requestResolver . isSLOURL ( ) ) { SAMLSSOValve . logger . log ( Level . FINE , "Processing<seq2seq4repair_space>Single<seq2seq4repair_space>Log<seq2seq4repair_space>Out<seq2seq4repair_space>URL..." ) ; saml2SSOManager = new SAML2SSOManager ( ssoAgentConfiguration ) ; if ( requestResolver . isHttpPostBinding ( ) ) { if ( Optional . ofNullable ( request . getSession ( false ) . getAttribute ( SESSION_BEAN_NAME ) ) . isPresent ( ) ) { ssoAgentConfiguration . getSAML2 ( ) . setPassiveAuthn ( false ) ; String htmlPayload = saml2SSOManager . buildPostRequest ( request , true ) ; saml2SSOManager . sendCharacterData ( response , htmlPayload ) ; } else { SAMLSSOValve . logger . log ( Level . WARNING , "Attempt<seq2seq4repair_space>to<seq2seq4repair_space>logout<seq2seq4repair_space>from<seq2seq4repair_space>a<seq2seq4repair_space>already<seq2seq4repair_space>logout<seq2seq4repair_space>session." ) ; response . sendRedirect ( request . getContext ( ) . getPath ( ) ) ; } } else { ssoAgentConfiguration . getSAML2 ( ) . setPassiveAuthn ( false ) ; response . sendRedirect ( saml2SSOManager . buildRedirectRequest ( request , true ) ) ; } return ; }

Fix:
if ( ( request . getRequest ( ) . getRequestURI ( ) . equals ( "//" ) ) || ( ! ( SSOUtils . singleSignOnEnabled ( ) ) ) ) {